FrançaisShown in its original language — a full translation is planned for a future version.
Multiples vulnérabilités dans le noyau Linux d'Ubuntu
view advisory published 2026-10-23
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (75)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-94266US | — | — | ||
libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither
the URL provided to libcurl nor the… | ||||
| CVE-2026-92391US | — | — | ||
A deeply nested multipart MIME structure constructed via the public API causes
a stack overflow in libcurl during normal cleanup operations. An excessive
recursion depth within `cu… | ||||
| CVE-2026-92389US | — | — | ||
libcurl's TFTP state machine fails to validate state transitions against the
requested transfer direction, accepting opening server responses for both
reads and writes interchangea… | ||||
| CVE-2026-92388US | — | — | ||
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the… | ||||
| CVE-2026-87864US | — | — | ||
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ b… | ||||
| CVE-2026-87863US | — | — | ||
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values c… | ||||
| CVE-2026-87862US | —OT elevated | — | ||
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy… | ||||
| CVE-2026-86414US | — | — | ||
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel reques… | ||||
| CVE-2026-86409US | — | — | ||
Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,
contrary to expectations and documentation. A subsequent transfer on the same
handle still sends an `… | ||||
| CVE-2026-106583US | high7.8 | — | ||
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | ||||
| CVE-2026-106587US | low3.3 | — | ||
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. | ||||
| CVE-2026-106586US | medium4.3 | — | ||
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73… | ||||
| CVE-2026-106585US | — | — | ||
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. | ||||
| CVE-2026-106584US | low3.3 | — | ||
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users… | ||||
| CVE-2026-106582US | — | — | ||
In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. | ||||
| CVE-2026-106555US | high7.5 | — | ||
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | ||||
| CVE-2026-106553US | high7.5 | — | ||
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | ||||
| CVE-2026-106552US | medium6.5 | — | ||
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. | ||||
| CVE-2019-25777US | — | — | ||
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution.
A perl/glob document names a… | ||||
| CVE-2017-20285US | — | — | ||
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.
A perl/hash:Class tag blesses a hash into the class it names. The do… | ||||
showing 20 of 75
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan